- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Norwegian Parliament – €195,000 Fine (Norway, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Norway's Datatilsynet fined the Norwegian Parliament EUR 195,000 after a data breach exposed sensitive information from members of parliament. The breach happened because the Parliament lacked proper security measures, like two-factor authentication, despite knowing about the risks. This case highlights the importance of strong security practices for protecting personal data.
What happened
The Norwegian Parliament suffered a data breach that exposed personal data from its members and staff.
Who was affected
Members of parliament and parliamentary administrative staff whose email accounts were accessed without authorization.
What the authority found
The DPA ruled that the Norwegian Parliament failed to implement adequate security measures, violating GDPR's requirements for data protection.
Why this matters
This ruling emphasizes that organizations must prioritize data security to protect personal information. Other public institutions should review their security protocols to prevent similar breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Norwegian DPA has fined the Norwegian Parliament EUR195,000. The parliament had suffered a data breach in which unauthorized persons gained access to the email accounts of members of parliament and parliamentary administrative staff. The attackers had succeeded in siphoning off the data, including personal data on bank accounts, dates of birth and health-related data. During its investigation, the DPA found that the parliament did not incorporate sufficient security mechanisms, such as two-factor authentication, even though a risk analysis in 2020 had found that this posed a high privacy risk. For this reason, the DPA found that the parliamentary administration had not taken appropriate technical and organizational measures to achieve a sufficient level of security.
Related Enforcement Actions (0)
No other enforcement actions found for Norwegian Parliament in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
4 March 2022
Authority
Datatilsynet (Norway)
Fine Amount
€195,000
About this data
Cite as: Cookie Fines. Norwegian Parliament - Norway (2022). Retrieved from cookiefines.eu
Last updated: